Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
361 detections
Filters
Last updated
All Time
Detection languages
155
66
39
27
23
Contributors
84
65
37
29
27
Categories
20,439
11,829
5,873
5,151
4,864
Platforms
188
168
165
59
24
Products / Services
141
115
50
36
28
MITRE Techniques
153
125
114
85
63
CVEs
6
5
5
5
5
IDS Classtypes
9
8
3
2
1
IDS Protocols
21
1
1
Detects successful authentication attempts to a LiteLLM proxy instance using the hardcoded default master key 'sk-1234'. This activity indicates potential exploitation of misconfigured instances where default credentials remain unchanged.
Detects successful authentication attempts to a LiteLLM proxy instance using the hardcoded default master key 'sk-1234'. This activity indicates potential exploitation of misconfigured instances where default credentials remain unchanged.
Detects successful authentication attempts to a LiteLLM proxy instance using the hardcoded default master key 'sk-1234'. This activity indicates potential exploitation of misconfigured instances where default credentials remain unchanged.
Detects attempts by non-privileged (non-PROXY_ADMIN) API keys to modify pass-through routes in LiteLLM via configuration update endpoints. This activity is indicative of exploitation of CVE-2026-35029, which allows unauthenticated or low-privilege users to bypass configuration restrictions.
Detects high-volume image pull activity against an Azure Container Registry from a single identity, which may indicate reconnaissance or mass harvesting of container images to extract embedded credentials, secrets, or source code.
Detects high-volume image pull activity against an Azure Container Registry from a single identity, which may indicate reconnaissance or mass harvesting of container images to extract embedded credentials, secrets, or source code.
Detects the initialization of containerized LLM-based gateway services (e.g., litellm, ollama) followed closely in time by high-volume network traffic containing suspicious web injection payloads (e.g., SQLi, XSS, SSRF). The rule correlates process execution events for container launches with network activity originating from the same device to identify potential unauthorized or unsupervised automated exploitation.
Detects the initialization of containerized LLM-based gateway services (e.g., litellm, ollama) followed closely in time by high-volume network traffic containing suspicious web injection payloads (e.g., SQLi, XSS, SSRF). The rule correlates process execution events for container launches with network activity originating from the same device to identify potential unauthorized or unsupervised automated exploitation.
This rule detects successful attempts by non-approved users or service accounts to delete, patch, or update Kubernetes PrometheusRule or AlertmanagerConfig resources. These resources control critical cluster monitoring and alerting; unauthorized changes could be used to disable security monitoring, modify alert notification channels to hide malicious activity, or tamper with detection capabilities.
This rule detects suspicious outbound network connections from common container runtime processes (e.g., containerd.exe, dockerd.exe) to well-known cloud instance metadata services (169.254.169.254, 100.100.100.200) or suspicious attempts to access container image manifests, which are indicative of SSRF attacks, credential theft from the metadata API, or potential container escape attempts.
This rule detects suspicious outbound network connections from common container runtime processes (e.g., containerd.exe, dockerd.exe) to well-known cloud instance metadata services (169.254.169.254, 100.100.100.200) or suspicious attempts to access container image manifests, which are indicative of SSRF attacks, credential theft from the metadata API, or potential container escape attempts.
Detects the execution of administrative or system-modifying tools (e.g., bash, sh, chroot, mount) or suspicious command lines involving root-level path manipulation or capability inspection (capsh) initiated by office applications, sandbox host processes, or specialized Excel engines. This behavior is indicative of a potential container breakout, privilege escalation, or post-exploitation activity originating from an initial access vector.
Detects the execution of administrative or system-modifying tools (e.g., bash, sh, chroot, mount) or suspicious command lines involving root-level path manipulation or capability inspection (capsh) initiated by office applications, sandbox host processes, or specialized Excel engines. This behavior is indicative of a potential container breakout, privilege escalation, or post-exploitation activity originating from an initial access vector.
This rule detects potential attempts to exploit kernel vulnerabilities related to the Stream Control Transmission Protocol (SCTP) within a containerized environment, followed by suspicious file creation activity in sensitive system directories (e.g., /root/). It correlates logs showing SCTP socket configuration activity with subsequent filesystem modifications within a short 5-minute window.
Detects credential and token harvesting behaviors associated with the ChainDrop/Shai-Hulud 2.0 npm worm, specifically targeting CI/CD environments. The rule monitors for unauthorized access to /proc/[pid]/mem to scrape memory for workflow secrets, extraction of OIDC environment variables, and suspicious invocation of the GitHub CLI (gh) to steal authentication tokens.
This rule detects potential attempts to exploit kernel vulnerabilities related to the Stream Control Transmission Protocol (SCTP) within a containerized environment, followed by suspicious file creation activity in sensitive system directories (e.g., /root/). It correlates logs showing SCTP socket configuration activity with subsequent filesystem modifications within a short 5-minute window.
Detects Python worker processes (e.g., dataset converters) spawning suspicious child processes (shells, network tools) or accessing sensitive filesystem paths/endpoints, such as Kubernetes service account tokens or cloud instance metadata, which are often indicative of post-exploitation activity following an SSTI or code injection vulnerability.
Detects file access/read of the in-cluster Kubernetes service account token path or a user's kubeconfig file by a non-standard binary (e.g. scripting interpreter, shell, or network utility) rather than known Kubernetes/orchestration tooling. Narrowed to reduce false positives from legitimate kubectl, helm, kubelet, and container runtime processes that routinely read these credentials.
Detects when the administrative user is enabled for an Azure Container Registry (ACR). Enabling this account provides a static username and password, which may bypass more secure authentication methods like Azure Active Directory-based access and increase the risk of credential exposure.
Detects the creation of a 'Ghost-in-the-Silo' configuration using bindutil.exe with the --runj flag. This pattern is often associated with unauthorized creation of silo-bound containers or execution environments and is monitored for activity outside of legitimate management processes like VM compute, container engines, or Windows Sandbox.
Detects the execution of tasks within Azure Container Registry that involve sensitive strings or potential credential-related patterns in the task configuration, such as 'secret-task', 'acb_step_0', or specific flag references, which may indicate testing or exploitation of container build pipelines.
Page 6 of 18